Project space metadata

implements
https://docs.google.com/a/dimagi.com/document/d/1ZpdRZLSstmnW_ubertb2jAMphssyOct_kWQ8YhpOhA0/edit#heading=h.i0ohvkukphfh

Restricts permission to domain admins (superusers permitted)

I chose not to use tastypie, since it would have been a mess to integrate with non-django ORM data
doesn't this handle it? https://github.com/dimagi/commcare-hq/blob/master/corehq/apps/domain/decorators.py#L141